[OpsMgr 2007R2][Opsmgr 2012] Alert Report in powershell script

Samuel Dubrul has posted an interesting powershell script to have a SCOM daily alert report. His script summarizes:

• Total number of alerts that occurred yesterday

This can indicate if there are a lot of monitors that are flip flopping

• The number of active alerts (total, critical, warning, informational)

This should always be as low as possible

• A sorted list of the “yesterday” alerts based on number of occurences and Name

These are the alerts on which you should start to work pro-actively , especially if the count is high.

• A sorted list of the current critical alerts, perhaps the most urgent ones to work on  

I've modified the script to be able to use it a a function ( see my post on Powershell Profile) you can add to your profile and added some functionnalities. In parameter you can define what number of day before today you want the report to start and also specify a duration...

A new sorted list has beed added : a Top 10 of alerts sorted by repeatcount  

Here is the new script : To be SCOM 2012 compliant, just replace get-alert by get-scomalert

1. Function AlertReport ([int] $DayBack,[int] $Duration) {
2. If ($DayBack -eq ""){$DayBack = 1}
3. If ($Duration -eq ""){$Duration = $DayBack}
4. #Get between dates Yesterday
5. $AlertDateBegin = [DateTime]::Today.AddDays(-$DayBack)
6. $SecondsToAdd = $Duration * 86399
7. $AlertDateEnd = [DateTime]::Today.AddDays(-$DayBack).AddSeconds($SecondsToAdd)
8. write-host "***********************************************************************" -foregroundcolor "Green"
9. write-host "ALERT REPORT:"      -foregroundcolor "Green"
10. write-host ""      -foregroundcolor "Green"
11. write-host "START DATE: $AlertDateBegin - END DATE: $AlertDateEnd" -foregroundcolor "Green"
12. write-host "***********************************************************************" -foregroundcolor "Green"
13. #Get yesterday alerts
14. $LastdayAlerts = @(get-alert | where {$_.TimeRaised -gt $AlertDateBegin -and $_.TimeRaised -lt $AlertDateEnd})
15. #write the output
16. write-host
17. write-host NUMBER OF ACTIVE ALERTS : ($LastdayAlerts).Count
18. write-host
19. write-host CURRENT NUMBER OF ACTIVE ALL           ALERTS: @(get-alert | where {$_.ResolutionState -ne '255'}).count
20. write-host CURRENT NUMBER OF ACTIVE CRITICAL      ALERTS: @(get-alert | where {$_.ResolutionState -ne '255' -and $_.Severity -eq '2'}).count  -foregroundcolor "red"
21. write-host CURRENT NUMBER OF ACTIVE WARNING       ALERTS: @(get-alert | where {$_.ResolutionState -ne '255' -and $_.Severity -eq '1'}).count  -foregroundcolor "yellow"
22. write-host CURRENT NUMBER OF ACTIVE INFORMATIONAL ALERTS: @(get-alert | where {$_.ResolutionState -ne '255' -and $_.Severity -eq '0'}).count
23. write-host
24. write-host
25. write-host TOPLIST OF ALERTS SORTED BY COUNT:
26. #list and sort yesterday alerts
27. $LastdayAlerts | Group-Object Name |Sort -desc Count | select-Object Count, Name |Format-Table –auto -wrap
28. write-host
29. write-host "TOP 10 LIST OF ALERTS SORTED BY REAPEATCOUNT WITH MONITORING OBJECT PATH"
30. #list top noisiest alerts
31. $LastdayAlerts | Sort -desc RepeatCount | select-object -first 10 Name, RepeatCount, MonitoringObjectPath |Format-Table –auto | Out-String -Width 4096
32. 
    
33. #list and sort current active alerts
34. write-host CURRENT ACTIVE CRITICAL ALERT LIST:  -foregroundcolor "red"
35. (get-alert | where {$_.ResolutionState -ne '255' -and $_.Severity -eq '2'} | Group-Object Name |Sort -desc Count | select-Object Count, Name |Format-Table –auto -wrap)
36. 
    
37. }

3 ways to use the AlertReport Function :

• First one, just execute the AlertReport with no parameter : this will give you a summary for the last past day.

• Execute AlertReport with one [int] parameter: this will generate a report for the [Int] last past days

• Execute AlertReport with 2 [int] parameters (for example AlertReport  3 2) : this will generate a report that start 3 days before today for a duration equals to 2 days.



Hope these modification will help some of you ! :)

Don't forget to use the reporting instead of using powershell script... you'll free one SDK connection !

This posting is provided "AS IS" with no warranties.